Use JSObjectVerify instead of trying to reimplement parts of it.

R=verwaest@chromium.org
BUG=chromium:573857
LOG=n

Review URL: https://codereview.chromium.org/1551333002

Cr-Commit-Position: refs/heads/master@{#33083}

src/objects-debug.cc

@@ -549,10 +549,7 @@ void SlicedString::SlicedStringVerify() {
 
 void JSBoundFunction::JSBoundFunctionVerify() {
   CHECK(IsJSBoundFunction());
-  if (HasFastProperties()) {
-    VerifyObjectField(kLengthOffset);
-    VerifyObjectField(kNameOffset);
-  }
+  JSObjectVerify();
   VerifyObjectField(kBoundThisOffset);
   VerifyObjectField(kBoundTargetFunctionOffset);
   VerifyObjectField(kBoundArgumentsOffset);

test/mjsunit/mjsunit.status

@@ -1002,6 +1002,7 @@
   'regress/regress-crbug-568477-3': [SKIP],
   'regress/regress-crbug-568477-4': [SKIP],
   'regress/regress-crbug-572590': [SKIP],
+  'regress/regress-crbug-573857': [SKIP],
   'regress/regress-deopt-gcb': [SKIP],
   'regress/regress-deopt-gc': [SKIP],
   'regress/regress-deopt-in-array-literal-spread': [SKIP],

test/mjsunit/regress/regress-crbug-573857.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --verify-heap
+
+function f() {}
+f = f.bind();
+f.x = f.name;
+f.__defineGetter__('name', function() { return f.x; });
+function g() {}
+g.prototype = f;
+gc();